CVE-2026-6187: Pharmacy Sales & Inventory System SQLi Flaw

CVE-2026-6187 Overview

A SQL injection vulnerability has been identified in SourceCodester Pharmacy Sales and Inventory System version 1.0. The vulnerability exists in the file /ajax.php?action=chk_prod_availability where the ID argument is improperly sanitized before being used in database queries. This flaw allows remote attackers to inject malicious SQL commands, potentially compromising the confidentiality, integrity, and availability of the underlying database.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract sensitive data, modify database records, or disrupt pharmacy operations without requiring authentication.

Affected Products

• SourceCodester Pharmacy Sales and Inventory System 1.0

Discovery Timeline

• April 13, 2026 - CVE-2026-6187 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-6187

Vulnerability Analysis

This vulnerability stems from inadequate input validation in the product availability checking functionality of the Pharmacy Sales and Inventory System. The application fails to properly sanitize user-supplied input in the ID parameter before incorporating it into SQL queries. This classic injection flaw allows attackers to manipulate the structure of database queries, enabling unauthorized data access or modification.

The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which encompasses injection vulnerabilities where user input is not properly sanitized before being used in a sensitive context.

Root Cause

The root cause of this vulnerability is the failure to implement parameterized queries or proper input sanitization for the ID parameter in the /ajax.php endpoint. When handling the chk_prod_availability action, the application directly concatenates user input into SQL statements without escaping special characters or validating that the input conforms to expected data types.

Attack Vector

The attack can be performed remotely over the network without requiring any authentication or user interaction. An attacker can craft malicious HTTP requests to the vulnerable endpoint, embedding SQL payloads in the ID parameter. The exploit has been publicly disclosed, which increases the risk of active exploitation against unpatched systems.

A typical attack would involve sending crafted requests to the /ajax.php?action=chk_prod_availability endpoint with SQL injection payloads in the ID parameter. Attackers may use techniques such as UNION-based injection to extract data, boolean-based blind injection to enumerate database contents, or time-based techniques when error messages are suppressed.

For detailed technical information about this vulnerability, refer to the GitHub Issue Report and VulDB Vulnerability #357109.

Detection Methods for CVE-2026-6187

Indicators of Compromise

• Unusual or malformed requests to /ajax.php?action=chk_prod_availability containing SQL keywords such as UNION, SELECT, DROP, or comment sequences like -- and /*
• Database error messages in application logs indicating syntax errors or unexpected query results
• Anomalous database activity patterns including bulk data extraction or unauthorized schema queries
• Web server access logs showing repeated requests to the vulnerable endpoint with varying ID parameter values

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SQL injection patterns targeting the ID parameter
• Configure intrusion detection systems (IDS) to alert on requests containing SQL metacharacters directed at /ajax.php
• Enable database query logging and monitor for anomalous queries originating from the web application
• Deploy application-layer monitoring to track request patterns to sensitive endpoints

Monitoring Recommendations

• Monitor web server access logs for requests to /ajax.php?action=chk_prod_availability with suspicious parameter values
• Set up alerts for database errors that may indicate injection attempts
• Implement real-time monitoring of database query patterns for signs of data exfiltration
• Review authentication logs for any unauthorized access following potential exploitation

How to Mitigate CVE-2026-6187

Immediate Actions Required

• Restrict access to the Pharmacy Sales and Inventory System to trusted networks only until a patch is applied
• Implement web application firewall rules to block SQL injection patterns on the affected endpoint
• Audit database access logs for signs of previous exploitation
• Consider taking the vulnerable endpoint offline if it is not critical to operations

Patch Information

As of the publication date, no official patch has been released by SourceCodester. Administrators should monitor the SourceCodester website for security updates. In the meantime, implementing the workarounds and detection measures outlined in this advisory is strongly recommended.

For additional vulnerability details, see the VulDB Submission #797375 and VulDB CTI Details #357109.

Workarounds

• Apply input validation to ensure the ID parameter accepts only numeric values before processing
• Implement parameterized queries or prepared statements in the affected PHP code
• Deploy a reverse proxy or WAF with SQL injection protection rules in front of the application
• Restrict database user permissions to limit potential impact from successful exploitation

The following example demonstrates how to implement input validation for the vulnerable parameter:

# Input validation example for PHP
# Validate that ID is a positive integer before use
$id = filter_input(INPUT_GET, 'ID', FILTER_VALIDATE_INT);
if ($id === false || $id <= 0) {
    die('Invalid product ID');
}
# Use prepared statements for database queries
$stmt = $pdo->prepare("SELECT * FROM products WHERE id = ?");
$stmt->execute([$id]);